In the Claims 



1. (Cancelled) 



2. (Currently amended) The method of claimj^ further comprising: 

scanning the file if there is no session stamp associated with the directory entry for 
the file; and 

creating a session stamp using the current session key as a result of the scan. 



3. (Currently amended)The method of claim^£ wherein updating the session stamp 
comprises invalidating the session stamp if the file is infected with a virus. 



4. (Currently amended) The method of claim y£ wherein the session stamp comprises an 
infection indicator and updating the session stamp comprises modifying the infection 
indicator when the file is infected with a virus. 



5. (Currently amended) The method of claimj^f wherein the session stamp comprises a 
signature and updating the session stamp comprises encrypting a known value with the 
current session key to create the signature. - 

6. (Currently amended) The method of claim jif wherein the session stamp comprises a 
signature and updating the session stamp comprises replacing a previous session key with 
the current session key. 



7. (Currently amended) The method of claim Ife wherein the session stamp comprises 
context information and updating the session stamp comprises replacing previous context 
information with current context information. 



8. (Currently amended) The method of claim 1^/wherein obtaining the session stamp, 
scanning the file, and updating the session stamp are performed when the file is accessed. 
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9. (Currently amended) The method of claim ^4, wherein obtaining the session stamp, 
scanning the file, and updating the session stamp are performed upon the file as a result of 
a user command. 



loading a pre-determined set of file identifiers, wherein obtaining the session 
stamp, scanning the file, and updating the session stamp are performed on each file 



11. (Original) The method of claim 10, wherein the pre-determined set of file identifiers 
is a most-recently-used cache of identifiers for the files that have been most recently used, 
and further comprising: 

adding an identifier for the file to the most-recently-used cache when the file is 
accessed; and 

storing the most-recently-used cache to non-volatile storage upon termination of 
the execution. 

12. (Original) The method of claim 10, wherein the pre-determined set of file identifiers 
is created from user input. 

13. (Original) The method of claim 10, wherein obtaining the session stamp, scanning the 
file, and updating the session stamp are performed as a background task on each file 
identified by the file identifiers. 



files for viruses comprising: 

generating a current session key upon an execution of the method; 

obtaining a session stamp associated with a directory entry for a file, wherein the 
session stamp is stored in an extended attributes section of the directory entry for the file; 



10. (Currently amended) The method of claim 14, further comprising: 




identified by the file identifiers. 
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scanning the file if the session stamp was created using a previous session key; 

and 

updating the session stamp as a result of the scan . 
^15. (Cancelled) 

(Currently amended) The computer-readable medium of claim 4420, further 
comprising: 

scanning the file if there is no session stamp associated with the directory entry for 
the file; and 

creating a session stamp using the current session key as a result of the scan. 

; > A 

VI. (Currently amended) The computer-readable medium of claim 4420/ wherein 
obtaining the session stamp, scanning the file, and updating the session stamp are 
performed when the file is accessed. 

l#rtCurrently amended) The computer-readable medium of claim 4-§26rwherein 
obtaining the session stamp, scanning the file, and updating the session stamp are 
performed upon the file as a result of a user command. 

>9TtCurrently amended) The computer-readable medium of claim 4 420T further 
comprising: 

loading a pre-determined set of file identifiers, wherein obtaining the session 
stamp, scanning the file, and updating the session stamp are performed on each file 
identified by the file identifier. 

(Currently amended) Th e comput e r r e adabl e m e dium of claim 15, A computer- 
readable medium having stored thereon executable instructions to cause a computer to 
perform a method comprising: 

generating a current session key upon an execution of the instructions; 
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obtaining a session stamp associated with a directory entry for a file, wherein the 
session stamp is stored in an extended attributes section of the directory entry for the file; 
scanning the file if the session stamp was created using a previous session key; 

and 

updating the session stamp as a result of the scan . 

^21. (Original) A computer-readable medium having stored thereon a session stamp data 
structure comprising: 

a file identifier field containing data representing an identifier for a file in a file 
system; and 

a signature field containing data created by an execution of an anti-virus process 
that last scanned the file identified by the file identifier field. 

-22fj[Original) The computer-readable medium of clainj^f wherein the data in the 
signature field represents a pre-determined value encrypted by a session key associated 
with the execution of the anti-virus process. 

(Original) The computer-readable medium of claim-21^wherein the data in the 
signature field represents a session key associated with the execution of the anti-virus 
process. 

-2<*fOriginal) The computer-readable medium of claim .2^further comprising: 

a scanner settings field containing data representing a configuration for the anti- 
virus process that last scanned the file identified by the file identifier field. 

-25T(Original) The computer-readable medium of clainr2tT further comprising: 

a scan result field containing data representing an infection status returned by the 
anti-virus process that last scanned the file identified by the file identifier field. 

. . j> q 

%o. (Original) The computer readable medium of claim-21; further comprising: 
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a time and date stamp field containing data representing a time and date the file 
identified by the file identifier field was last modified. 

JOT. (Original) The computer-readable medium of claim^i^ further comprising: 

a size field containing data representing a size for the file identified by the file 
identifier field. 

28f(Original) A computer system comprising: 

a processor coupled to a system bus; 

a memory coupled to the processor through the system bus; 

a computer-readable medium coupled to the processor through the system bus; 

a virus scanning process executed from the computer-readable medium by the 
processor, wherein the scanning process causes the processor to generate a current session 
key when the scanning process is executed from the computer-readable medium, and 
further to obtain a session stamp associated with a directory entry for a file from the 
computer-readable medium, to scan the file if the session stamp was created using a 
previous session key, and to update the session stamp on the computer-readable medium 
as a result of the scan. 

^9^(Original) The computer system of claim ^ wherein the virus scanning process 
further causes the processor to scan the file if there is no session stamp associated with 
the directory entry for the file on the computer-readable medium, to create a session 
stamp using the current session key as a result of the scan, and to store the session stamp 
in the directory entry for the file on the computer-readable medium. 

}v. (Original) The computer system of claim ^8, further comprising a user input device 
coupled to the processor through the system bus, wherein input from the user input device 
instructs the virus scanning process to scan the file. 
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(Original) The computer system of claim 28, further comprising an application 
process executed from the computer-readable medium by the process, wherein a request 
from the application process for the file causes the processor to scan the file. 



32ffOriginal) A method for communicating between an anti-virus process and a session 
stamping process comprising: 

issuing, by the anti-virus process, an enable-session-key call; 

receiving, by the session stamping process, the enable-session-key call and, in 
response thereto, initializing a stamping session and generating a session key; 

issuing, by the anti-virus process, a disable-session-key call; and 

receiving, by the session stamping process, the disable-session-key call and, in 
response thereto, disabling the stamping session. 

6\< 3D 

^ (Original) The method of claim further comprising: 

issuing, by the anti-virus process, a stamp-file-with-session-stamp call having a 
file parameter; and 

receiving, by the session stamping process, the stamp-file-with-session-stamp call 
and, in response thereto, generating a session stamp using the session key and associating 
the session stamp with a file identified by the file parameter. 

(Original) The method of claim wherein the stamp-file-with-session-stamp call 
further has an engine parameter identifying context information used to generate the 
session stamp. 

9 ■■ J 1 

y>. (Original) The method of claim wherein the stamp-file-with-session-stamp call 
further has an iam parameter identifying the anti-virus process currently calling the 
session stamping process. 

^(Original) The method of claim ^ further comprising: 

issuing, by the anti-virus process, a delete-session-stamp call having a file 
parameter; and 
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receiving, by the session stamping process, the delete-session-stamp call and, in 
response thereto, deleting any session stamp associated with the file identified by the file 
parameter. 

37: (Original) The method of claim Ju, further comprising: 

issuing, by the anti-virus process, a has-file-got- valid-session-stamp call having a 
file parameter; 

receiving, by the session stamping process, the has-file-got- valid-session-stamp 
call and, in response thereto, determining a validity for any session stamp associated with 
the file identified by the file parameter; and 

returning, by the session stamping process, the validity to the anti-virus process. 

^8^(Original) The method of claim yf, wherein the has-file-got- valid-session-stamp call 
further has an engine parameter identifying context information used to determine the 
validity of the session stamp. 

^^(Original) The method of claim 57/ wherein the has-file-got- valid-session-stamp call 
further has an iam parameter identifying the anti-virus process currently calling the 
session stamping process. 

& 35 

>Kff (Original) The method of claim 37fwherein the has-file-got-valid-session-stamp call 
further has a signer parameter, and further comprising: 

returning, by the session stamping process, an identifier for the anti-virus process 
that last called the session stamping process as the signer parameter. 
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